Bank of America data breach history (2016-2026): Infosys McCamish, Merrill and the PPP upload
Bank of America’s notified incidents since 2016 are a vendor ransomware attack, an employee email error at Merrill and a mistaken upload during the 2020 Paycheck Protection Program rush. None was a hack of the bank’s own network. Each is dated and sourced below.
Short answer
Was Bank of America hacked?
We found no confirmed hack of Bank of America’s own systems from 2016 to 2026 in the sources we read. The largest incident was at a vendor: Infosys McCamish Systems, which administered deferred compensation plans for the bank, was breached around 3 November 2023. A notice filed with Maine’s Attorney General put the number of affected Bank of America customers at 57,028. LockBit claimed the attack.
Two smaller incidents were the bank’s own mistakes. In April 2024 a Merrill employee emailed names and Social Security numbers of 1,883 Walmart 401(k) participants to an unauthorised recipient. In April 2020 Bank of America uploaded PPP loan applications to an SBA test platform where other authorised lenders could briefly see them.
Timeline at a glance
May 2024Merrill tells Maine AG an employee email error exposed 1,883 Walmart 401(k) participants’ SSNs. (InvestmentNews)Confirmed
Feb 2024Customers notified of the Infosys McCamish breach: 57,028 people per the Maine AG notice. (Hackread / Maine AG)Confirmed
4 Nov 2023LockBit claims the Infosys McCamish attack, saying it encrypted over 2,000 systems. (Hackread)Unverified claim
3 Nov 2023Unauthorised access to Infosys McCamish systems; Bank of America told on 24 Nov. (Hackread)Confirmed
22 Apr 2020PPP applications uploaded to an SBA test platform visible to other lenders. (Bank Info Security)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Bank of America incident timeline, in detail
Confirmed = acknowledged by Bank of America, a regulator filing or a court. Reported = credible reporting Bank of America has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Apr – May 2024ConfirmedOwn staff / misdirected email
Merrill employee emails Walmart 401(k) participants’ SSNs to the wrong person
What happened. Merrill, Bank of America’s wealth unit and recordkeeper for the Walmart 401(k) Plan, told the Maine Attorney General that “a Merrill employee inadvertently disclosed personal information to an unauthorized recipient via an isolated email error.” It learned of it on 22 April 2024; the notice is dated 23 May 2024.
Impact. 1,883 plan participants. First and last names and Social Security numbers. The email was deleted; Merrill said it knew of no misuse and offered two years of Experian credit monitoring.
Nov 2023 – Feb 2024ConfirmedThird-party / plan administrator
Infosys McCamish Systems ransomware attack exposes 57,028 Bank of America customers
What happened. An unauthorised party accessed systems of Infosys McCamish Systems (IMS), which ran deferred compensation plans for Bank of America, on 3 November 2023. Bank of America learned of it on 24 November 2023 and notified customers in early February 2024. LockBit claimed the attack on 4 November 2023, saying it encrypted over 2,000 systems; that figure is the gang’s claim.
Impact. Per the Maine AG notice reported by Hackread: 57,028 people, 93 of them in Maine. Possibly exposed: names, addresses, Social Security numbers, dates of birth and plan account information. IMS said it could not determine which items were viewed. Bank of America said its own systems were not compromised and offered two years of Experian identity protection.
Apr – May 2020ConfirmedOwn process / government platform
PPP loan applications briefly visible to other lenders on an SBA test platform
What happened. On 22 April 2020 Bank of America uploaded clients’ Paycheck Protection Program applications to a “limited access” SBA test platform. The data was visible for a limited time to a limited number of other SBA-authorised lenders and their vendors. The SBA removed it the same day, Bank Info Security reported.
Impact. Possibly exposed: business address and tax ID, and the owner’s name, address, SSN, phone, email and citizenship. The bank did not say how many clients were affected, said it did not believe anyone viewed the data, and offered two years of identity protection.
Infosys McCamish scope: the 57,028 figure is from the Maine AG notice; IMS said it could not pinpoint which data was viewed, so “exposed” means potentially accessed, not confirmed stolen.
Merrill email date: InvestmentNews says Merrill learned of it on 22 April 2024; other reports quoting the Maine notice give 16 April 2024 as the email date (via search; we could not open the notice). Both may be correct (send date vs discovery date).
The pattern across the record
Plan administration is the soft spot
Both the McCamish and Merrill incidents involved retirement or deferred-compensation plan data, where SSNs are held in bulk by recordkeepers.
Small human errors still get notified
A single misdirected email and a test upload each led to state notices and two years of credit monitoring. Bank of America reports small incidents rather than absorbing them.
What it means for Bank of America For Bank of America and Merrill customers and plan participants — and what to do
If you got a Bank of America, Merrill or Infosys McCamish letter, the data most likely included your SSN.
1.Freeze your credit and enrol in the monitoring
A credit freeze with the three US bureaus is free. Enrol in the two-year Experian membership offered in the letter.
We found no confirmed hack of Bank of America’s own systems from 2016 to 2026. Its largest incident was the 2023 ransomware attack on its vendor Infosys McCamish Systems, which exposed data of 57,028 customers per a Maine AG notice.
Bank of America data breach 2024: what happened?+
In February 2024 Bank of America notified 57,028 customers that their deferred-compensation plan data may have been taken in the November 2023 attack on Infosys McCamish. In May 2024 Merrill reported an email error that exposed SSNs of 1,883 Walmart 401(k) participants.
What data was exposed in the Infosys McCamish breach?+
Possibly names, addresses, Social Security numbers, dates of birth and plan account information. IMS said it could not determine exactly which items were viewed.
Who was behind the Bank of America vendor breach?+
The LockBit ransomware gang claimed the attack on Infosys McCamish on 4 November 2023. Bank of America said its own systems were not compromised.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Bank of America. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.